jamarir's blog

Write

[HackTheBox] Mantis
Just another IIS & MSSQL Creds Leaks / sqsh & DBeaver (TLS-free) / CVE Lookup / MS14-068 Write-up. Machine Link. IppSec Walkthough. This is the first HTB’s Active Directory machine. Foothold Open ports Scanning the ports against our target reveals ...
Sep 11, 202526 min read
[HackTheBox] Administrator
Just another GenericAll / ForceChangePassword / Cypher / Password Safe 3 / GenericWrite & targeted kerberoast / DCSync Write-up. As is common in real life Windows pentests, you will start the Administrator box with credentials for the following acco...
Aug 19, 202510 min read
J
jamarir's blog
40 posts
Just another inoS̸̡̨̹͎͋̉̈́́̚ec blog. Why ? Because teaching oneself iS̵̢̢̡̢̟̮̘̬̹͖͇̺̪͖̬͚̝͈͇̣̺̮̝̤̺͚͊̓̈́̔̐̋̒̓͂͆̌̓̉̿͑͐̿̒̈́̉͊́͆̿̓̕͘͠ͅ the best way to leÂ©rn. Only hack your own/allowed environments.
[HackTheBox] Intelligence
Just another Pass Spray / ADIDNS Poisoning / NTLMv2 Crack / gMSA Password / Constrained Delegation (S4U) / msDS-ManagedPassword Constructed Attribute (LDAP Req) Write-up. CTF Link. IppSec Walkthrough. Foothold Open ports The SYN and NSE scan agains...
Jun 21, 202525 min read
[HackTheBox] Timelapse
Just another ZIP & PFX Cracking / WinRM Cert Auth / PSReadLine ConsoleHost_History Leak / LAPS / RDP (socat) & SAM reg over DC (?) Write-up. Machine Link. IppSec Walkthrough. Foothold Open ports The Nmap scan reveals the following open ports: jamar...
May 30, 202522 min read
[GameHacking] Subnautica Below Zero - Unity3D Modding - dnSpy Tips & Tricks
Just another dnSpy Write-up. This article is a pragmatic introduction into the Unity3D Modding world. Our focus will be to edit the game’s logic using dnSpy, based upon the Steam version of the Subnautica Below Zero (SEP-2022 49371) game. To follow ...
May 3, 202518 min read
[PicoCTF] Format String Attack - 0x101
Just another %n Format-Type Specifier / Stackpops vs. Direct Access Parameters (NULL) / Stack Misalignments / PLT & GOT Alteration / Pwntools fmtstr() Write-up. In the context of this article, the ASLR mechanism will be disabled for local debugging ...
Apr 27, 202535 min read
[PicoCTF] Buffer Overflow - 0x101
Just another SIGSEGV / strcpy() / gets() / args alteration / brute-forced canaries write-up. Buffer Overflow 0 Challenge link. Let's start off simple, can you overflow the correct buffer? The program is available here. You can view source here. Conn...
Apr 12, 202517 min read
Shellcode i386 - 0x101
Just another c2asm / cdecl / .data / .text / int 0x80 / execve / bad chars cleanup Write-up. Reversing C code 0×101 Program Let’s consider the following main.c code: int add(int x, int y) { return x + y; } void main() { int z = add(1, 2); ...
Apr 6, 202524 min read
[HackTheBox] Certified
Just another jq Parsing / Ownership DACL Abuse / PKINIT / Shadow Credentials / ESC9 Vulnerable Template / UPN Mismatch (?) / Certificate Mapping Write-up. As is common in Windows pentests, you will start the Certified box with credentials for the fo...
Mar 18, 202530 min read

Command Palette

Latest articles